Deployment Architecture

Install DB Connect1 on indexer

karabsze
Path Finder

Hi all,

We are going to use DB Connect 1 to get data from Database. And we would like to setup the dbx on the indexer instead on search head.
Is there any other possible impact if we have no usage on reporting or database lookups?

Many THanks!

Best Regards,
Karab

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

You only need DBX installed somewhere it can put data into the indexer. Once it's in and searchable in Splunk, then you have no further need of the DBX app for that data - though of course you still need it to get new data in.

IMO, the impact of the DBX stuff if you aren't using the DBX stuff is negligible.

This is all assuming you are not using dbquery to generate all your stuff but are instead using regular DBX-based inputs to "read" the tables/data you want and index it. If you are trying to write your searches using dbquery, then I'd think you would need the dbx stuff installed on the search heads because the search itself will attempt to talk to the DB in question. I'd recommend not generally doing that as it changes the loads on the systems involved.

I hope this answers this question, as I'm not entirely sure I understood it correctly but thought I'd give it a shot anyway.

View solution in original post

Richfez
SplunkTrust
SplunkTrust

You only need DBX installed somewhere it can put data into the indexer. Once it's in and searchable in Splunk, then you have no further need of the DBX app for that data - though of course you still need it to get new data in.

IMO, the impact of the DBX stuff if you aren't using the DBX stuff is negligible.

This is all assuming you are not using dbquery to generate all your stuff but are instead using regular DBX-based inputs to "read" the tables/data you want and index it. If you are trying to write your searches using dbquery, then I'd think you would need the dbx stuff installed on the search heads because the search itself will attempt to talk to the DB in question. I'd recommend not generally doing that as it changes the loads on the systems involved.

I hope this answers this question, as I'm not entirely sure I understood it correctly but thought I'd give it a shot anyway.

karabsze
Path Finder

Thanks rich.

Yes, I am just using the dbx as a modular input. That is good to hear that the impact is negligible in the view of DBX stuff. Do you know if DBX setup might decrease the stability on the indexers?

Moreover, I agreed that using dbquery directly would increase the difficulty to control the loading to db. :

0 Karma

Richfez
SplunkTrust
SplunkTrust

Glad I could answer the first questions.

To be complete and answer the remaining ones:

I would very much doubt it would affect stability or performance or anything else on the indexer.

I don't think the DBX app does anything "automatically" until and unless you've configured some dbmon inputs. So, without any inputs, dbx should just be more or less a set of files (relatively small) on disk in your $splunkhome$/etc/apps directory. There are some apps that "do things" behind the scenes, but I don't think this one is one of them. Nothing significant, anyway.

All in all, I'd not worry about the dbx app and its components. Obviously, I can't guarantee anything, but honestly, it's pretty well behaved and when not configured to do anything it ... won't do anything. 🙂 Even when configured to do things, it still is pretty well behaved, not affecting much else except with whatever general load it causes.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

If your indexers don't have Java, it definitely won't do anything

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...